Data Processing Addendum

"Data Protection Laws" means all laws applicable to the processing of personal data under the Agreement, including Regulation (EU) 2016/679 ("GDPR"); the GDPR as incorporated into UK law by the European Union (Withdrawal) Act 2018 together with the Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); and US state privacy laws including the California Consumer Privacy Act as amended ("CCPA").

"Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in the GDPR.

"Customer Personal Data" means personal data within customer data that StackSpend processes on Customer's behalf, as described in Annex I.

"SCCs" means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued under section 119A of the Data Protection Act 2018, version B1.0.

"Sub-processor" means a third party engaged by StackSpend to process Customer Personal Data.

2.1 In respect of Customer Personal Data, Customer is the Controller and StackSpend is the Processor.

2.2 Where Customer is itself a processor acting for a third-party controller, Customer warrants that it has that controller's authority to appoint StackSpend as a sub-processor on these terms.

2.3 StackSpend acts as an independent controller in respect of account administration and billing, security monitoring and fraud prevention carried out for its own compliance purposes, and visitors to its public marketing website. That processing is governed by the Privacy Policy, not by this Addendum.

3.1 StackSpend processes Customer Personal Data only on Customer's documented instructions, including as to transfers to a third country, unless required to do otherwise by law to which StackSpend is subject. Where StackSpend is so required, it will inform Customer before processing unless the law prohibits it on important grounds of public interest.

3.2 The Terms of Service, this Addendum, and Customer's use of the features and settings of the Service constitute Customer's complete documented instructions.

3.3 StackSpend will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

3.4 Read-only access. Customer supplies read-only credentials for its cloud and AI providers. StackSpend uses those credentials solely to retrieve billing and usage data, and has no write access to Customer's infrastructure or provider accounts.

3.5 Restrictions. StackSpend will not: (a) sell or share Customer Personal Data as those terms are defined under the CCPA; (b) retain, use or disclose Customer Personal Data for any purpose other than performing the Service, or outside the direct business relationship between the parties; (c) combine Customer Personal Data with personal data from another source except as permitted by Data Protection Laws; or (d) use Customer Personal Data, cost or usage data, budgets, reports or dashboard activity for advertising or profiling, or to train machine learning models. StackSpend certifies that it understands and will comply with these restrictions.

StackSpend ensures that persons authorised to process Customer Personal Data are subject to an appropriate obligation of confidentiality, and that access is limited to personnel who require it to deliver the Service.

5.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to data subjects, StackSpend implements and maintains the technical and organisational measures set out in Annex II.

5.2 StackSpend may update those measures provided the overall level of security is not materially reduced.

6.1 Customer grants StackSpend general written authorisation to engage sub-processors, subject to this section. The current list is at Annex III and is published at stackspend.app/legal/sub-processors.

6.2 StackSpend will notify Customer of any intended addition or replacement of a sub-processor at least thirty (30) days before that sub-processor begins processing Customer Personal Data, by email to Customer's administrative contact and by updating the published list referred to in section 6.1.

6.3 Customer may object on reasonable data-protection grounds within fifteen (15) days of notification. The parties will work in good faith to resolve the objection. Failing resolution, Customer may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees for the unused remainder of the term.

6.4 StackSpend imposes on each sub-processor data protection obligations no less protective than those in this Addendum, and remains fully liable for each sub-processor's performance.

7.1 Taking into account the nature of the processing, StackSpend assists Customer by appropriate technical and organisational measures, insofar as possible, in meeting Customer's obligation to respond to requests under Chapter III of the GDPR.

7.2 The Service provides self-service access, export, correction and deletion. Where a request cannot be fulfilled through that functionality, StackSpend provides reasonable assistance on request.

7.3 If StackSpend receives a request directly from a data subject relating to Customer Personal Data, it will not respond substantively but will promptly forward the request to Customer, unless legally prohibited.

8.1 StackSpend will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting Customer Personal Data.

8.2 The notification will describe, so far as known, the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where information is not available at the time, it will follow in phases without further undue delay.

8.3 StackSpend will reasonably cooperate with and assist Customer in respect of Customer's own notification obligations to supervisory authorities and data subjects.

StackSpend provides reasonable assistance with any data protection impact assessment and prior consultation with a supervisory authority required under Articles 35 and 36 of the GDPR, taking into account the nature of the processing and the information available to StackSpend.

The Service provides self-service functionality for the matters covered by sections 7 and 9. Where Customer requests assistance that goes beyond that functionality and requires material StackSpend effort, StackSpend may charge a reasonable fee based on time spent at its then-current rates, notified to Customer in advance and subject to Customer's approval before the work is undertaken. StackSpend will not charge for assistance required as a result of its own breach of this Addendum.

10.1 StackSpend makes available to Customer the information reasonably necessary to demonstrate compliance with this Addendum.

10.2 StackSpend will respond to a reasonable security questionnaire no more than once per twelve (12) month period, and will make available any third-party audit reports or certifications it then holds.

10.3 Where that information is insufficient, Customer may conduct an audit no more than once per twelve (12) month period, on thirty (30) days' written notice, during business hours, subject to reasonable confidentiality undertakings, and without unreasonably disrupting StackSpend's operations. Customer bears its own costs and StackSpend's reasonable costs. The frequency limit does not apply where a supervisory authority requires an audit. Following a personal data breach affecting Customer Personal Data, Customer may conduct one additional audit in respect of that breach.

11.1 Customer authorises StackSpend to transfer Customer Personal Data outside the United Kingdom, the European Economic Area and Switzerland — including to the United States, where StackSpend's sub-processors operate — subject to appropriate safeguards.

11.2 EEA transfers. Where Customer Personal Data originating in the EEA is transferred to a country without an adequacy decision, the SCCs (Module Two: Controller to Processor) are incorporated by reference, with: Clause 7 (docking clause) included; Clause 9(a) Option 2 (general written authorisation) applying, with the notice period in section 6.2 above; the optional wording in Clause 11(a) excluded; Clause 17 governed by the law of Ireland; Clause 18(b) specifying the courts of Ireland; and Annexes I, II and III of the SCCs populated by Annexes I, II and III of this Addendum.

11.3 UK transfers. Where Customer Personal Data originating in the UK is transferred, the UK Addendum is incorporated by reference and applies to the SCCs, with Tables 1 to 3 populated by the details in this Addendum and Table 4 selecting "neither party" as the party that may terminate on a change to the Approved Addendum.

11.4 Swiss transfers. Where Customer Personal Data originating in Switzerland is transferred, the SCCs apply with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent authority, and "Member State" read so as not to prevent data subjects in Switzerland from suing in their place of habitual residence.

11.5 If a transfer mechanism relied on under this section is invalidated, the parties will work in good faith to put an alternative lawful mechanism in place without undue delay.

12.1 On termination or expiry of the Agreement, StackSpend will, at Customer's election, delete or return Customer Personal Data and delete existing copies, unless retention is required by law.

12.2 Where Customer makes no election, StackSpend deletes Customer Personal Data in accordance with its published retention practices, and in any event within thirty (30) days of account deletion. This section is subject to sections 12.4, 12.5 and 12.6.

12.3 Customer may export its data through the Service at any time during the term.

12.4 StackSpend may retain Customer Personal Data to the extent required by law, provided it continues to protect that data under this Addendum and processes it only for the purpose of that legal requirement.

12.5 Backups. Customer Personal Data contained in routine backups and point-in-time recovery snapshots is deleted on StackSpend's ordinary backup rotation cycle rather than within the period in section 12.2. Until it is deleted, such data is retained solely for disaster recovery, is isolated from active processing, and remains subject to this Addendum.

12.6 Audit logs. StackSpend retains audit logs for the period stated in Annex I, including after account deletion, as a security and compliance record in its capacity as an independent controller under section 2.3. Audit logs are processed only for that purpose and are permanently deleted at the end of that period.

13.1 Customer warrants that: (a) it has a lawful basis for the processing it instructs StackSpend to carry out; (b) it has given all notices and obtained all consents required under Data Protection Laws; (c) its instructions comply with Data Protection Laws; and (d) it will not submit to the Service special category data within the meaning of Article 9 GDPR, criminal offence data within the meaning of Article 10 GDPR, or the personal data of children.

13.2 Customer is responsible for the Customer content it submits to features that transmit that content for automated analysis, as described in Annex III, including source-control correlation and cost-intelligence chat. Customer shall ensure that content submitted to those features is appropriate to be sent for analysis.

13.3 Customer shall indemnify StackSpend against all losses, liabilities and reasonable costs arising from a breach of section 13.1.

Each party's liability under this Addendum is subject to the exclusions and limitations of liability in the Terms of Service.

15.1 This Addendum takes effect on the effective date above and continues for as long as StackSpend processes Customer Personal Data. Except as amended here, the Terms of Service remain in full force.

15.2 This Addendum is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales, except where the SCCs or UK Addendum require otherwise under section 11.

15.3 StackSpend may update this Addendum to reflect changes in Data Protection Laws or its processing operations. Material changes will be notified by email at least thirty (30) days before they take effect, and the current version is always published on this page. This section applies equally to any executed copy of this Addendum, so that a signed copy does not diverge from the current version.